kong icon indicating copy to clipboard operation
kong copied to clipboard

Make OAuth 2.0 redirect URIs regexes.

Open ikogan opened this issue 8 years ago • 3 comments

Summary

This addresses https://github.com/Mashape/kong/issues/1397 by making the redirect URIs a regex. This is necessary for any application that allows a user to login on arbitrary pages within the application. While this could be handled by saving that information in the app locally, that creates additional development overhead and complexity. I'm hoping this change doesn't qualify as breaking, although it's not a simple bugfix and does change behavior. If so, I can rebase off of next instead.

Full Changelog

  • Add table_contains_regex that mirrors old table_contains and use it when checking if the supplied redirect URI is valid for a given client. This method simply uses ngx.re.match instead of a simple equality check.
  • Add migrations to prepend all redirect URIs with '^' and append '$' to ensure that existing exact match behavior is preserved on upgrade.
  • If no redirect URI is specified, the first entry in the list is still used but the '^' and '$' characters are removed. This is hacky, feedback is appreciated.
  • Add related tests.

Issues resolved

Fix #1397

ikogan avatar Jul 27 '17 20:07 ikogan

Thanks for the comments, I really appreciated the input. Hopefully I've addressed some of them and I'll comment on the others.

ikogan avatar Aug 01 '17 14:08 ikogan

Will this feature be merged into master, and when? I've encounter the situation that the redirect_uri is like https://example.com/xxx/xxx?token=xxx which the token parameter is dynamic.

zeghong avatar Sep 15 '18 02:09 zeghong

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

CLAassistant avatar Jul 01 '19 06:07 CLAassistant

Closing because of lack of activity. We would like to accept this contribution if anyone wishes to pick this back up.

hbagdi avatar Oct 25 '22 21:10 hbagdi